@atproto/jwk 0.1.0

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,eAAO,MAAM,eAAe,kGAGuB,CAAA;AAEnD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,eAAO,MAAM,WAAW,SAAU,OAAO,4CACA,CAAA;AAEzC,eAAO,MAAM,iBAAiB,wFAGqB,CAAA;AAEnD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,eAAO,MAAM,aAAa,SAAU,OAAO,kCACA,CAAA;AAE3C;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B,yCAAyC;;IAEzC,2CAA2C;;IAE3C,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;IAW5C,sCAAsC;;IAEtC,yCAAyC;;IAEzC,uDAAuD;;IAEvD,kEAAkE;;IAElE,yEAAyE;;IAEzE,oCAAoC;;IAEpC,4CAA4C;;IAE5C,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzC,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAGvD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;YApC3B,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAAzC,yCAAyC;;;;;;;;;;;;;;;;4CA2BzC,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA3B5C,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAAzC,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAAzC,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAAzC,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+IzC,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA"}

package/dist/jwt.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtPayloadSchema = exports.jwtHeaderSchema = exports.isUnsignedJwt = exports.unsignedJwtSchema = exports.isSignedJwt = exports.signedJwtSchema = void 0;
+const zod_1 = require("zod");
+const jwk_js_1 = require("./jwk.js");
+const util_js_1 = require("./util.js");
+exports.signedJwtSchema = zod_1.z
+    .string()
+    .superRefine(util_js_1.jwtCharsRefinement)
+    .superRefine((0, util_js_1.segmentedStringRefinementFactory)(3));
+const isSignedJwt = (data) => exports.signedJwtSchema.safeParse(data).success;
+exports.isSignedJwt = isSignedJwt;
+exports.unsignedJwtSchema = zod_1.z
+    .string()
+    .superRefine(util_js_1.jwtCharsRefinement)
+    .superRefine((0, util_js_1.segmentedStringRefinementFactory)(2));
+const isUnsignedJwt = (data) => exports.unsignedJwtSchema.safeParse(data).success;
+exports.isUnsignedJwt = isUnsignedJwt;
+/**
+ * @see {@link https://www.rfc-editor.org/rfc/rfc7515.html#section-4}
+ */
+exports.jwtHeaderSchema = zod_1.z.object({
+    /** "alg" (Algorithm) Header Parameter */
+    alg: zod_1.z.string(),
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku: zod_1.z.string().url().optional(),
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk: zod_1.z
+        .object({
+        kty: zod_1.z.string(),
+        crv: zod_1.z.string().optional(),
+        x: zod_1.z.string().optional(),
+        y: zod_1.z.string().optional(),
+        e: zod_1.z.string().optional(),
+        n: zod_1.z.string().optional(),
+    })
+        .optional(),
+    /** "kid" (Key ID) Header Parameter */
+    kid: zod_1.z.string().optional(),
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u: zod_1.z.string().optional(),
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c: zod_1.z.array(zod_1.z.string()).optional(),
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t: zod_1.z.string().optional(),
+    /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header Parameter */
+    'x5t#S256': zod_1.z.string().optional(),
+    /** "typ" (Type) Header Parameter */
+    typ: zod_1.z.string().optional(),
+    /** "cty" (Content Type) Header Parameter */
+    cty: zod_1.z.string().optional(),
+    /** "crit" (Critical) Header Parameter */
+    crit: zod_1.z.array(zod_1.z.string()).optional(),
+});
+// https://www.iana.org/assignments/jwt/jwt.xhtml
+exports.jwtPayloadSchema = zod_1.z.object({
+    iss: zod_1.z.string().optional(),
+    aud: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string()).nonempty()]).optional(),
+    sub: zod_1.z.string().optional(),
+    exp: zod_1.z.number().int().optional(),
+    nbf: zod_1.z.number().int().optional(),
+    iat: zod_1.z.number().int().optional(),
+    jti: zod_1.z.string().optional(),
+    htm: zod_1.z.string().optional(),
+    htu: zod_1.z.string().optional(),
+    ath: zod_1.z.string().optional(),
+    acr: zod_1.z.string().optional(),
+    azp: zod_1.z.string().optional(),
+    amr: zod_1.z.array(zod_1.z.string()).optional(),
+    // https://datatracker.ietf.org/doc/html/rfc7800
+    cnf: zod_1.z
+        .object({
+        kid: zod_1.z.string().optional(), // Key ID
+        jwk: jwk_js_1.jwkPubSchema.optional(), // JWK
+        jwe: zod_1.z.string().optional(), // Encrypted key
+        jku: zod_1.z.string().url().optional(), // JWK Set URI ("kid" should also be provided)
+        // https://datatracker.ietf.org/doc/html/rfc9449#section-6.1
+        jkt: zod_1.z.string().optional(),
+        // https://datatracker.ietf.org/doc/html/rfc8705
+        'x5t#S256': zod_1.z.string().optional(), // X.509 Certificate SHA-256 Thumbprint
+        // https://datatracker.ietf.org/doc/html/rfc9203
+        osc: zod_1.z.string().optional(), // OSCORE_Input_Material carrying the parameters for using OSCORE per-message security with implicit key confirmation
+    })
+        .optional(),
+    client_id: zod_1.z.string().optional(),
+    scope: zod_1.z.string().optional(),
+    nonce: zod_1.z.string().optional(),
+    at_hash: zod_1.z.string().optional(),
+    c_hash: zod_1.z.string().optional(),
+    s_hash: zod_1.z.string().optional(),
+    auth_time: zod_1.z.number().int().optional(),
+    // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+    // OpenID: "profile" scope
+    name: zod_1.z.string().optional(),
+    family_name: zod_1.z.string().optional(),
+    given_name: zod_1.z.string().optional(),
+    middle_name: zod_1.z.string().optional(),
+    nickname: zod_1.z.string().optional(),
+    preferred_username: zod_1.z.string().optional(),
+    gender: zod_1.z.string().optional(), // OpenID only defines "male" and "female" without forbidding other values
+    picture: zod_1.z.string().url().optional(),
+    profile: zod_1.z.string().url().optional(),
+    website: zod_1.z.string().url().optional(),
+    birthdate: zod_1.z
+        .string()
+        .regex(/\d{4}-\d{2}-\d{2}/) // YYYY-MM-DD
+        .optional(),
+    zoneinfo: zod_1.z
+        .string()
+        .regex(/^[A-Za-z0-9_/]+$/)
+        .optional(),
+    locale: zod_1.z
+        .string()
+        .regex(/^[a-z]{2}(-[A-Z]{2})?$/)
+        .optional(),
+    updated_at: zod_1.z.number().int().optional(),
+    // OpenID: "email" scope
+    email: zod_1.z.string().optional(),
+    email_verified: zod_1.z.boolean().optional(),
+    // OpenID: "phone" scope
+    phone_number: zod_1.z.string().optional(),
+    phone_number_verified: zod_1.z.boolean().optional(),
+    // OpenID: "address" scope
+    // https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim
+    address: zod_1.z
+        .object({
+        formatted: zod_1.z.string().optional(),
+        street_address: zod_1.z.string().optional(),
+        locality: zod_1.z.string().optional(),
+        region: zod_1.z.string().optional(),
+        postal_code: zod_1.z.string().optional(),
+        country: zod_1.z.string().optional(),
+    })
+        .optional(),
+    // https://datatracker.ietf.org/doc/html/rfc9396#section-14.2
+    authorization_details: zod_1.z
+        .array(zod_1.z
+        .object({
+        type: zod_1.z.string(),
+        // https://datatracker.ietf.org/doc/html/rfc9396#section-2.2
+        locations: zod_1.z.array(zod_1.z.string()).optional(),
+        actions: zod_1.z.array(zod_1.z.string()).optional(),
+        datatypes: zod_1.z.array(zod_1.z.string()).optional(),
+        identifier: zod_1.z.string().optional(),
+        privileges: zod_1.z.array(zod_1.z.string()).optional(),
+    })
+        .passthrough())
+        .optional(),
+});
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,qCAAuC;AACvC,uCAAgF;AAEnE,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,WAAW,CAAC,4BAAkB,CAAC;KAC/B,WAAW,CAAC,IAAA,0CAAgC,EAAC,CAAC,CAAC,CAAC,CAAA;AAG5C,MAAM,WAAW,GAAG,CAAC,IAAa,EAAqB,EAAE,CAC9D,uBAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD5B,QAAA,WAAW,eACiB;AAE5B,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,WAAW,CAAC,4BAAkB,CAAC;KAC/B,WAAW,CAAC,IAAA,0CAAgC,EAAC,CAAC,CAAC,CAAC,CAAA;AAG5C,MAAM,aAAa,GAAG,CAAC,IAAa,EAAuB,EAAE,CAClE,yBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD9B,QAAA,aAAa,iBACiB;AAE3C;;GAEG;AACU,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,yCAAyC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;IACf,2CAA2C;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,4CAA4C;IAC5C,GAAG,EAAE,OAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC;SACD,QAAQ,EAAE;IACb,sCAAsC;IACtC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uDAAuD;IACvD,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,kEAAkE;IAClE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yEAAyE;IACzE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,oCAAoC;IACpC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,4CAA4C;IAC5C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAIF,iDAAiD;AACpC,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,gDAAgD;IAChD,GAAG,EAAE,OAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS;QACrC,GAAG,EAAE,qBAAY,CAAC,QAAQ,EAAE,EAAE,MAAM;QACpC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB;QAC5C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,8CAA8C;QAEhF,4DAA4D;QAC5D,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAE1B,gDAAgD;QAChD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uCAAuC;QAE1E,gDAAgD;QAChD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qHAAqH;KAClJ,CAAC;SACD,QAAQ,EAAE;IAEb,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,uEAAuE;IAEvE,0BAA0B;IAC1B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0EAA0E;IACzG,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,CAAC,CAAC,aAAa;SACxC,QAAQ,EAAE;IACb,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,kBAAkB,CAAC;SACzB,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,CAAC;SAC/B,QAAQ,EAAE;IACb,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEvC,wBAAwB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,wBAAwB;IACxB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,0BAA0B;IAC1B,qEAAqE;IACrE,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb,6DAA6D;IAC7D,qBAAqB,EAAE,OAAC;SACrB,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE;QAChB,4DAA4D;QAC5D,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;SACD,WAAW,EAAE,CACjB;SACA,QAAQ,EAAE;CACd,CAAC,CAAA"}

package/dist/key.d.ts

@@ -0,0 +1,38 @@
+import { Jwk } from './jwk.js';
+import { VerifyOptions, VerifyPayload, VerifyResult } from './jwt-verify.js';
+import { JwtHeader, JwtPayload, SignedJwt } from './jwt.js';
+export declare abstract class Key {
+    protected readonly jwk: Readonly<Jwk>;
+    constructor(jwk: Readonly<Jwk>);
+    get isPrivate(): boolean;
+    get isSymetric(): boolean;
+    get privateJwk(): Jwk | undefined;
+    get publicJwk(): Jwk | undefined;
+    get bareJwk(): Jwk | undefined;
+    get use(): "sig" | "enc";
+    /**
+     * The (forced) algorithm to use. If not provided, the key will be usable with
+     * any of the algorithms in {@link algorithms}.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 | "alg" (Algorithm) Header Parameter Values for JWS}
+     */
+    get alg(): string | undefined;
+    get kid(): string | undefined;
+    get crv(): "P-256" | "P-384" | "P-521" | "secp256k1" | "Ed25519" | "Ed448" | undefined;
+    /**
+     * All the algorithms that this key can be used with. If `alg` is provided,
+     * this set will only contain that algorithm.
+     */
+    get algorithms(): readonly string[];
+    /**
+     * Create a signed JWT
+     */
+    abstract createJwt(header: JwtHeader, payload: JwtPayload): Promise<SignedJwt>;
+    /**
+     * Verify the signature, headers and payload of a JWT
+     *
+     * @throws {JwtVerifyError} if the JWT is invalid
+     */
+    abstract verifyJwt<P extends VerifyPayload = JwtPayload, C extends string = string>(token: SignedJwt, options?: VerifyOptions<C>): Promise<VerifyResult<P, C>>;
+}
+//# sourceMappingURL=key.d.ts.map

package/dist/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAa,MAAM,UAAU,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAG3D,8BAAsB,GAAG;IACX,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;gBAAlB,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;IAKjD,IAAI,SAAS,IAAI,OAAO,CAKvB;IAED,IAAI,UAAU,IAAI,OAAO,CAIxB;IAED,IAAI,UAAU,IAAI,GAAG,GAAG,SAAS,CAEhC;IAED,IACI,SAAS,IAAI,GAAG,GAAG,SAAS,CAO/B;IAED,IACI,OAAO,IAAI,GAAG,GAAG,SAAS,CAI7B;IAED,IAAI,GAAG,kBAEN;IAED;;;;;OAKG;IACH,IAAI,GAAG,uBAEN;IAED,IAAI,GAAG,uBAEN;IAED,IAAI,GAAG,gFAEN;IAED;;;OAGG;IACH,IACI,UAAU,IAAI,SAAS,MAAM,EAAE,CAElC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAE9E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAChB,CAAC,SAAS,aAAa,GAAG,UAAU,EACpC,CAAC,SAAS,MAAM,GAAG,MAAM,EACzB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC7E"}

package/dist/key.js

@@ -0,0 +1,131 @@
+"use strict";
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Key = void 0;
+const alg_js_1 = require("./alg.js");
+const errors_js_1 = require("./errors.js");
+const jwk_js_1 = require("./jwk.js");
+const util_js_1 = require("./util.js");
+let Key = (() => {
+    var _a;
+    let _instanceExtraInitializers = [];
+    let _get_publicJwk_decorators;
+    let _get_bareJwk_decorators;
+    let _get_algorithms_decorators;
+    return _a = class Key {
+            constructor(jwk) {
+                Object.defineProperty(this, "jwk", {
+                    enumerable: true,
+                    configurable: true,
+                    writable: true,
+                    value: (__runInitializers(this, _instanceExtraInitializers), jwk)
+                });
+                // A key should always be used either for signing or encryption.
+                if (!jwk.use)
+                    throw new errors_js_1.JwkError('Missing "use" Parameter value');
+            }
+            get isPrivate() {
+                const { jwk } = this;
+                if ('d' in jwk && jwk.d !== undefined)
+                    return true;
+                if ('k' in jwk && jwk.k !== undefined)
+                    return true;
+                return false;
+            }
+            get isSymetric() {
+                const { jwk } = this;
+                if ('k' in jwk && jwk.k !== undefined)
+                    return true;
+                return false;
+            }
+            get privateJwk() {
+                return this.isPrivate ? this.jwk : undefined;
+            }
+            get publicJwk() {
+                if (this.isSymetric)
+                    return undefined;
+                if (this.isPrivate) {
+                    const { d: _, ...jwk } = this.jwk;
+                    return jwk;
+                }
+                return this.jwk;
+            }
+            get bareJwk() {
+                if (this.isSymetric)
+                    return undefined;
+                const { kty, crv, e, n, x, y } = this.jwk;
+                return jwk_js_1.jwkSchema.parse({ crv, e, kty, n, x, y });
+            }
+            get use() {
+                return this.jwk.use;
+            }
+            /**
+             * The (forced) algorithm to use. If not provided, the key will be usable with
+             * any of the algorithms in {@link algorithms}.
+             *
+             * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 | "alg" (Algorithm) Header Parameter Values for JWS}
+             */
+            get alg() {
+                return this.jwk.alg;
+            }
+            get kid() {
+                return this.jwk.kid;
+            }
+            get crv() {
+                return this.jwk.crv;
+            }
+            /**
+             * All the algorithms that this key can be used with. If `alg` is provided,
+             * this set will only contain that algorithm.
+             */
+            get algorithms() {
+                return Array.from((0, alg_js_1.jwkAlgorithms)(this.jwk));
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _get_publicJwk_decorators = [util_js_1.cachedGetter];
+            _get_bareJwk_decorators = [util_js_1.cachedGetter];
+            _get_algorithms_decorators = [util_js_1.cachedGetter];
+            __esDecorate(_a, null, _get_publicJwk_decorators, { kind: "getter", name: "publicJwk", static: false, private: false, access: { has: obj => "publicJwk" in obj, get: obj => obj.publicJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _get_bareJwk_decorators, { kind: "getter", name: "bareJwk", static: false, private: false, access: { has: obj => "bareJwk" in obj, get: obj => obj.bareJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _get_algorithms_decorators, { kind: "getter", name: "algorithms", static: false, private: false, access: { has: obj => "algorithms" in obj, get: obj => obj.algorithms }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a;
+})();
+exports.Key = Key;
+//# sourceMappingURL=key.js.map

package/dist/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAAwC;AACxC,2CAAsC;AACtC,qCAAyC;AAGzC,uCAAwC;IAElB,GAAG;;;;;;sBAAH,GAAG;YACvB,YAA+B,GAAkB;gBAArC;;;;4BADQ,mDAAG,EACQ,GAAG;mBAAe;gBAC/C,gEAAgE;gBAChE,IAAI,CAAC,GAAG,CAAC,GAAG;oBAAE,MAAM,IAAI,oBAAQ,CAAC,+BAA+B,CAAC,CAAA;YACnE,CAAC;YAED,IAAI,SAAS;gBACX,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;gBACpB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,IAAI,UAAU;gBACZ,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;gBACpB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,IAAI,UAAU;gBACZ,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9C,CAAC;YAGD,IAAI,SAAS;gBACX,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,SAAS,CAAA;gBACrC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAU,CAAA;oBACxC,OAAO,GAAG,CAAA;gBACZ,CAAC;gBACD,OAAO,IAAI,CAAC,GAAG,CAAA;YACjB,CAAC;YAGD,IAAI,OAAO;gBACT,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,SAAS,CAAA;gBACrC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,GAAU,CAAA;gBAChD,OAAO,kBAAS,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAI,CAAA;YACtB,CAAC;YAED;;;;;eAKG;YACH,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;YACrB,CAAC;YAED,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;YACrB,CAAC;YAED,IAAI,GAAG;gBACL,OAAQ,IAAI,CAAC,GAA2D,CAAC,GAAG,CAAA;YAC9E,CAAC;YAED;;;eAGG;YAEH,IAAI,UAAU;gBACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAA,sBAAa,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,CAAC;;;;yCA9CA,sBAAY;uCAUZ,sBAAY;0CAiCZ,sBAAY;YA1Cb,gLAAI,SAAS,6DAOZ;YAGD,0KAAI,OAAO,6DAIV;YA6BD,mLAAI,UAAU,6DAEb;;;;;AArEmB,kBAAG"}

package/dist/keyset.d.ts

@@ -0,0 +1,41 @@
+import { Jwks } from './jwks.js';
+import { VerifyOptions, VerifyResult } from './jwt-verify.js';
+import { JwtHeader, JwtPayload, SignedJwt } from './jwt.js';
+import { Key } from './key.js';
+import { Override } from './util.js';
+export type JwtSignHeader = Override<JwtHeader, Pick<KeySearch, 'alg' | 'kid'>>;
+export type JwtPayloadGetter<P = JwtPayload> = (header: JwtHeader, key: Key) => P | PromiseLike<P>;
+export type KeySearch = {
+    use?: 'sig' | 'enc';
+    kid?: string | string[];
+    alg?: string | string[];
+};
+export declare class Keyset<K extends Key = Key> implements Iterable<K> {
+    /**
+     * The preferred algorithms to use when signing a JWT using this keyset.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
+     */
+    readonly preferredSigningAlgorithms: readonly string[];
+    private readonly keys;
+    constructor(iterable: Iterable<K | null | undefined | false>, 
+    /**
+     * The preferred algorithms to use when signing a JWT using this keyset.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
+     */
+    preferredSigningAlgorithms?: readonly string[]);
+    get signAlgorithms(): readonly string[];
+    get publicJwks(): Jwks;
+    get privateJwks(): Jwks;
+    has(kid: string): boolean;
+    get(search: KeySearch): K;
+    list(search: KeySearch): Generator<K>;
+    findKey({ kid, alg, use }: KeySearch): [key: Key, alg: string];
+    [Symbol.iterator](): IterableIterator<K>;
+    createJwt({ alg: sAlg, kid: sKid, ...header }: JwtSignHeader, payload: JwtPayload | JwtPayloadGetter): Promise<SignedJwt>;
+    verifyJwt<P extends Record<string, unknown> = JwtPayload, C extends string = string>(token: SignedJwt, options?: VerifyOptions<C>): Promise<VerifyResult<P, C> & {
+        key: K;
+    }>;
+}
+//# sourceMappingURL=keyset.d.ts.map

package/dist/keyset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyset.d.ts","sourceRoot":"","sources":["../src/keyset.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EACL,QAAQ,EAKT,MAAM,WAAW,CAAA;AAElB,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;AAE/E,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAC7C,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,GAAG,KACL,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAEvB,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACxB,CAAA;AAKD,qBAAa,MAAM,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,YAAW,QAAQ,CAAC,CAAC,CAAC;IAK3D;;;;OAIG;aACa,0BAA0B,EAAE,SAAS,MAAM,EAAE;IAT/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;gBAGjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;IAChD;;;;OAIG;IACa,0BAA0B,GAAE,SAAS,MAAM,EAetD;IAmBP,IACI,cAAc,IAAI,SAAS,MAAM,EAAE,CAWtC;IAED,IACI,UAAU,IAAI,IAAI,CAIrB;IAED,IACI,WAAW,IAAI,IAAI,CAItB;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC;IAWxB,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;IAwBtC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;IAsC9D,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAIlC,SAAS,CACb,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,aAAa,EAClD,OAAO,EAAE,UAAU,GAAG,gBAAgB,GACrC,OAAO,CAAC,SAAS,CAAC;IAef,SAAS,CACb,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,EAC9C,CAAC,SAAS,MAAM,GAAG,MAAM,EAEzB,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;QAAE,GAAG,EAAE,CAAC,CAAA;KAAE,CAAC;CAwB5C"}

package/dist/keyset.js

@@ -0,0 +1,234 @@
+"use strict";
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Keyset = void 0;
+const errors_js_1 = require("./errors.js");
+const jwt_decode_js_1 = require("./jwt-decode.js");
+const util_js_1 = require("./util.js");
+const extractPrivateJwk = (key) => key.privateJwk;
+const extractPublicJwk = (key) => key.publicJwk;
+let Keyset = (() => {
+    var _a;
+    let _instanceExtraInitializers = [];
+    let _get_signAlgorithms_decorators;
+    let _get_publicJwks_decorators;
+    let _get_privateJwks_decorators;
+    return _a = class Keyset {
+            constructor(iterable, 
+            /**
+             * The preferred algorithms to use when signing a JWT using this keyset.
+             *
+             * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
+             */
+            preferredSigningAlgorithms = iterable instanceof
+                _a
+                ? [...iterable.preferredSigningAlgorithms]
+                : [
+                    // Prefer elliptic curve algorithms
+                    'EdDSA',
+                    'ES256K',
+                    'ES256',
+                    // https://datatracker.ietf.org/doc/html/rfc7518#section-3.5
+                    'PS256',
+                    'PS384',
+                    'PS512',
+                    'HS256',
+                    'HS384',
+                    'HS512',
+                ]) {
+                Object.defineProperty(this, "preferredSigningAlgorithms", {
+                    enumerable: true,
+                    configurable: true,
+                    writable: true,
+                    value: (__runInitializers(this, _instanceExtraInitializers), preferredSigningAlgorithms)
+                });
+                Object.defineProperty(this, "keys", {
+                    enumerable: true,
+                    configurable: true,
+                    writable: true,
+                    value: void 0
+                });
+                const keys = [];
+                const kids = new Set();
+                for (const key of iterable) {
+                    if (!key)
+                        continue;
+                    keys.push(key);
+                    if (key.kid) {
+                        if (kids.has(key.kid))
+                            throw new errors_js_1.JwkError(`Duplicate key: ${key.kid}`);
+                        else
+                            kids.add(key.kid);
+                    }
+                }
+                this.keys = Object.freeze(keys);
+            }
+            get signAlgorithms() {
+                const algorithms = new Set();
+                for (const key of this) {
+                    if (key.use !== 'sig')
+                        continue;
+                    for (const alg of key.algorithms) {
+                        algorithms.add(alg);
+                    }
+                }
+                return Object.freeze([...algorithms].sort((0, util_js_1.preferredOrderCmp)(this.preferredSigningAlgorithms)));
+            }
+            get publicJwks() {
+                return {
+                    keys: Array.from(this, extractPublicJwk).filter(util_js_1.isDefined),
+                };
+            }
+            get privateJwks() {
+                return {
+                    keys: Array.from(this, extractPrivateJwk).filter(util_js_1.isDefined),
+                };
+            }
+            has(kid) {
+                return this.keys.some((key) => key.kid === kid);
+            }
+            get(search) {
+                for (const key of this.list(search)) {
+                    return key;
+                }
+                throw new errors_js_1.JwkError(`Key not found ${search.kid || search.alg || '<unknown>'}`, errors_js_1.ERR_JWK_NOT_FOUND);
+            }
+            *list(search) {
+                // Optimization: Empty string or empty array will not match any key
+                if (search.kid?.length === 0)
+                    return;
+                if (search.alg?.length === 0)
+                    return;
+                for (const key of this) {
+                    if (search.use && key.use !== search.use)
+                        continue;
+                    if (Array.isArray(search.kid)) {
+                        if (!key.kid || !search.kid.includes(key.kid))
+                            continue;
+                    }
+                    else if (search.kid) {
+                        if (key.kid !== search.kid)
+                            continue;
+                    }
+                    if (Array.isArray(search.alg)) {
+                        if (!search.alg.some((a) => key.algorithms.includes(a)))
+                            continue;
+                    }
+                    else if (typeof search.alg === 'string') {
+                        if (!key.algorithms.includes(search.alg))
+                            continue;
+                    }
+                    yield key;
+                }
+            }
+            findKey({ kid, alg, use }) {
+                const matchingKeys = [];
+                for (const key of this.list({ kid, alg, use })) {
+                    // Not a signing key
+                    if (!key.isPrivate)
+                        continue;
+                    // Skip negotiation if a specific "alg" was provided
+                    if (typeof alg === 'string')
+                        return [key, alg];
+                    matchingKeys.push(key);
+                }
+                const isAllowedAlg = (0, util_js_1.matchesAny)(alg);
+                const candidates = matchingKeys.map((key) => [key, key.algorithms.filter(isAllowedAlg)]);
+                // Return the first candidates that matches the preferred algorithms
+                for (const prefAlg of this.preferredSigningAlgorithms) {
+                    for (const [matchingKey, matchingAlgs] of candidates) {
+                        if (matchingAlgs.includes(prefAlg))
+                            return [matchingKey, prefAlg];
+                    }
+                }
+                // Return any candidate
+                for (const [matchingKey, matchingAlgs] of candidates) {
+                    for (const alg of matchingAlgs) {
+                        return [matchingKey, alg];
+                    }
+                }
+                throw new errors_js_1.JwkError(`No singing key found for ${kid || alg || use || '<unknown>'}`, errors_js_1.ERR_JWK_NOT_FOUND);
+            }
+            [(_get_signAlgorithms_decorators = [util_js_1.cachedGetter], _get_publicJwks_decorators = [util_js_1.cachedGetter], _get_privateJwks_decorators = [util_js_1.cachedGetter], Symbol.iterator)]() {
+                return this.keys.values();
+            }
+            async createJwt({ alg: sAlg, kid: sKid, ...header }, payload) {
+                try {
+                    const [key, alg] = this.findKey({ alg: sAlg, kid: sKid, use: 'sig' });
+                    const protectedHeader = { ...header, alg, kid: key.kid };
+                    if (typeof payload === 'function') {
+                        payload = await payload(protectedHeader, key);
+                    }
+                    return await key.createJwt(protectedHeader, payload);
+                }
+                catch (err) {
+                    throw errors_js_1.JwtCreateError.from(err);
+                }
+            }
+            async verifyJwt(token, options) {
+                const { header } = (0, jwt_decode_js_1.unsafeDecodeJwt)(token);
+                const { kid, alg } = header;
+                const errors = [];
+                for (const key of this.list({ kid, alg })) {
+                    try {
+                        const result = await key.verifyJwt(token, options);
+                        return { ...result, key };
+                    }
+                    catch (err) {
+                        errors.push(err);
+                    }
+                }
+                switch (errors.length) {
+                    case 0:
+                        throw new errors_js_1.JwtVerifyError('No key matched', errors_js_1.ERR_JWKS_NO_MATCHING_KEY);
+                    case 1:
+                        throw errors_js_1.JwtVerifyError.from(errors[0], errors_js_1.ERR_JWT_INVALID);
+                    default:
+                        throw errors_js_1.JwtVerifyError.from(errors, errors_js_1.ERR_JWT_INVALID);
+                }
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            __esDecorate(_a, null, _get_signAlgorithms_decorators, { kind: "getter", name: "signAlgorithms", static: false, private: false, access: { has: obj => "signAlgorithms" in obj, get: obj => obj.signAlgorithms }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _get_publicJwks_decorators, { kind: "getter", name: "publicJwks", static: false, private: false, access: { has: obj => "publicJwks" in obj, get: obj => obj.publicJwks }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _get_privateJwks_decorators, { kind: "getter", name: "privateJwks", static: false, private: false, access: { has: obj => "privateJwks" in obj, get: obj => obj.privateJwks }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a;
+})();
+exports.Keyset = Keyset;
+//# sourceMappingURL=keyset.js.map

package/dist/keyset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyset.js","sourceRoot":"","sources":["../src/keyset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOoB;AAGpB,mDAAiD;AAIjD,uCAMkB;AAelB,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAmB,EAAE,CAAC,GAAG,CAAC,UAAU,CAAA;AACvE,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAmB,EAAE,CAAC,GAAG,CAAC,SAAS,CAAA;IAExD,MAAM;;;;;;sBAAN,MAAM;YAGjB,YACE,QAAgD;YAChD;;;;eAIG;YACa,6BAAgD,QAAQ;gBACxE,EAAM;gBACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,0BAA0B,CAAC;gBAC1C,CAAC,CAAC;oBACE,mCAAmC;oBACnC,OAAO;oBACP,QAAQ;oBACR,OAAO;oBACP,4DAA4D;oBAC5D,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;iBACR;gBAfL;;;;4BAVS,mDAAM,EAUC,0BAA0B;mBAerC;gBAxBU;;;;;mBAAkB;gBA0BjC,MAAM,IAAI,GAAQ,EAAE,CAAA;gBAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;gBAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC3B,IAAI,CAAC,GAAG;wBAAE,SAAQ;oBAElB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAEd,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;wBACZ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;4BAAE,MAAM,IAAI,oBAAQ,CAAC,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAA;;4BACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjC,CAAC;YAGD,IAAI,cAAc;gBAChB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;gBACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;wBAAE,SAAQ;oBAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;wBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBACrB,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAiB,EAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CACzE,CAAA;YACH,CAAC;YAGD,IAAI,UAAU;gBACZ,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,mBAAS,CAAC;iBAC3D,CAAA;YACH,CAAC;YAGD,IAAI,WAAW;gBACb,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,mBAAS,CAAC;iBAC5D,CAAA;YACH,CAAC;YAED,GAAG,CAAC,GAAW;gBACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,GAAG,CAAC,MAAiB;gBACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,OAAO,GAAG,CAAA;gBACZ,CAAC;gBAED,MAAM,IAAI,oBAAQ,CAChB,iBAAiB,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,EAC1D,6BAAiB,CAClB,CAAA;YACH,CAAC;YAED,CAAC,IAAI,CAAC,MAAiB;gBACrB,mEAAmE;gBACnE,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;oBAAE,OAAM;gBACpC,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;oBAAE,OAAM;gBAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;wBAAE,SAAQ;oBAElD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;4BAAE,SAAQ;oBACzD,CAAC;yBAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;wBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;4BAAE,SAAQ;oBACtC,CAAC;oBAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;4BAAE,SAAQ;oBACnE,CAAC;yBAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;4BAAE,SAAQ;oBACpD,CAAC;oBAED,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAa;gBAClC,MAAM,YAAY,GAAU,EAAE,CAAA;gBAE9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC/C,oBAAoB;oBACpB,IAAI,CAAC,GAAG,CAAC,SAAS;wBAAE,SAAQ;oBAE5B,oDAAoD;oBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ;wBAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBAE9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACxB,CAAC;gBAED,MAAM,YAAY,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CACjC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAU,CAC7D,CAAA;gBAED,oEAAoE;gBACpE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBACtD,KAAK,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;wBACrD,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;4BAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;oBACnE,CAAC;gBACH,CAAC;gBAED,uBAAuB;gBACvB,KAAK,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;oBACrD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;wBAC/B,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;oBAC3B,CAAC;gBACH,CAAC;gBAED,MAAM,IAAI,oBAAQ,CAChB,4BAA4B,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,WAAW,EAAE,EAC9D,6BAAiB,CAClB,CAAA;YACH,CAAC;YAED,oCAzGC,sBAAY,iCAcZ,sBAAY,kCAOZ,sBAAY,GAoFZ,MAAM,CAAC,QAAQ,EAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAA;YAC3B,CAAC;YAED,KAAK,CAAC,SAAS,CACb,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,EAAiB,EAClD,OAAsC;gBAEtC,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;oBACrE,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAA;oBAExD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;wBAClC,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;oBAC/C,CAAC;oBAED,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;gBACtD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,0BAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAChC,CAAC;YACH,CAAC;YAED,KAAK,CAAC,SAAS,CAIb,KAAgB,EAChB,OAA0B;gBAE1B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;gBAE3B,MAAM,MAAM,GAAc,EAAE,CAAA;gBAE5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAO,KAAK,EAAE,OAAO,CAAC,CAAA;wBACxD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAA;oBAC3B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAClB,CAAC;gBACH,CAAC;gBAED,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,KAAK,CAAC;wBACJ,MAAM,IAAI,0BAAc,CAAC,gBAAgB,EAAE,oCAAwB,CAAC,CAAA;oBACtE,KAAK,CAAC;wBACJ,MAAM,0BAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,2BAAe,CAAC,CAAA;oBACvD;wBACE,MAAM,0BAAc,CAAC,IAAI,CAAC,MAAM,EAAE,2BAAe,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;;;;YA3JD,+LAAI,cAAc,6DAWjB;YAGD,mLAAI,UAAU,6DAIb;YAGD,sLAAI,WAAW,6DAId;;;;;AAtEU,wBAAM"}